Canonical Multipass CVE-2026-49237

Requires (1) Canonical Multipass for macOS installed at a vulnerable version below 1.16.3 in its default install path /Library/Application Support/com.canonical.multipass/bin/, (2) a local interactive or shell-level foothold on the machine as the user account that originally installed Multipass (or any account with write access to that directory, which by default is the installing user), and (3) the multipassd LaunchDaemon being loaded and subsequently invoking one of the five planted auxiliary binaries - multipass, qemu-img, qemu-system-aarch64, qemu-system-x86_64, or sshfs_server - which occurs during routine operations such as multipass launch. Limiting factors: exploitation is local-only (AV:L), so remote network attackers cannot reach it; the attacker must already possess the installing user's privileges (PR:L) rather than an arbitrary low-privilege account on a multi-user system; and the daemon must actually execute the planted binary, which depends on Multipass usage frequency on the host.

The CVSS 7.8 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects a high-impact local privilege escalation requiring only low-privilege local access and no user interaction - a strong fit for post-foothold escalation on developer workstations. No EPSS score, KEV listing, or SSVC decision data was provided in the input, and no public POC is referenced beyond the vendor's GHSA advisory, so real-world exploitation breadth cannot be quantified from the available signals. Real-world risk is meaningful because Multipass is commonly installed by developers who already hold an interactive session on the same machine, making the 'local attacker' precondition trivially satisfied in the intended deployment context; however, this is not a remote/internet-exposed issue and should be prioritized as a workstation hardening item rather than an emergency network-facing patch.

A local user with a standard account on a macOS workstation that has Multipass installed overwrites /Library/Application Support/com.canonical.multipass/bin/qemu-img with a malicious binary or shell-script wrapper that drops a setuid root payload. The user (or any other user/process) then triggers normal Multipass activity such as multipass launch, multipass start, or any operation that causes multipassd to shell out to qemu-img by bare name; because the root LaunchDaemon's PATH resolves the user-writable directory first, the planted binary executes as root, yielding full privilege escalation. No public exploit code was identified in the provided references, but the technique is straightforward and reliable given local write access.